fix: compile-time config validation and egress policy

- Remove url/live_view from config/config.exs (prevents dev config from baking into releases)
- Move url/live_view to config/dev.exs and config/test.exs
- Add validate_compile_env: false to release config in mix.exs
- Fix egress network policy to allow DB at 10.0.19.30:6432 (PgBouncer)
- Add RELEASE_VALIDATE_COMPILE_ENV to init container env

config/config.exs

@@ -25,13 +25,11 @@ config :aprsme, Aprsme.PromEx,
 
 # Configures the endpoint
 config :aprsme, AprsmeWeb.Endpoint,
-  url: [host: "localhost"],
   render_errors: [
     formats: [html: AprsmeWeb.ErrorHTML, json: AprsmeWeb.ErrorJSON],
     layout: false
   ],
-  pubsub_server: Aprsme.PubSub,
-  live_view: [signing_salt: "dev-signing-salt-local-only"]
+  pubsub_server: Aprsme.PubSub
 
 # Configure Gettext with supported locales from AprsmeWeb.Gettext module
 config :aprsme, AprsmeWeb.Gettext,

config/dev.exs

@@ -41,7 +41,9 @@ config :aprsme, AprsmeWeb.Endpoint,
   # Binding to loopback ipv4 address prevents access from other machines.
   # Change to `ip: {0, 0, 0, 0}` to allow access from other machines.
   adapter: Bandit.PhoenixAdapter,
+  url: [host: "localhost"],
   http: [ip: {127, 0, 0, 1}, port: 4000],
+  live_view: [signing_salt: "dev-signing-salt-local-only"],
   check_origin: false,
   code_reloader: true,
   debug_errors: true,

config/test.exs

@@ -36,7 +36,9 @@ config :aprsme, Aprsme.Repo,
 # you can enable the server option below.
 config :aprsme, AprsmeWeb.Endpoint,
   adapter: Bandit.PhoenixAdapter,
+  url: [host: "localhost"],
   http: [ip: {127, 0, 0, 1}, port: 4002],
+  live_view: [signing_salt: "test-signing-salt-local-only"],
   secret_key_base: "IV9+ENaw9i8xjReRk4sULRvRgsmFVTGQwQGGrf4G+Q/SFMeHBCNWRlPXQ2YvT36R",
   server: false
 

k8s/deployment.yaml

@@ -78,6 +78,8 @@ spec:
                 secretKeyRef:
                   name: aprs-secrets
                   key: SECRET_KEY_BASE
+            - name: RELEASE_VALIDATE_COMPILE_ENV
+              value: "false"
           envFrom:
             - secretRef:
                 name: aprs-db

k8s/networkpolicy-egress.yaml

@@ -43,16 +43,12 @@ spec:
       ports:
         - port: 443
           protocol: TCP
-    # Database egress (PostgreSQL — if in-cluster, restrict to DB pod)
-    # Update the podSelector if your PostgreSQL runs in-cluster with a specific label.
-    # If your DB is external, this is covered by the 0.0.0.0/0 catch-all above on port 5432.
+    # Database egress (PgBouncer + direct PostgreSQL)
     - to:
         - ipBlock:
-            cidr: 0.0.0.0/0
-            except:
-              - 10.0.0.0/8
-              - 172.16.0.0/12
-              - 192.168.0.0/16
+            cidr: 10.0.19.30/32
       ports:
+        - port: 6432
+          protocol: TCP
         - port: 5432
           protocol: TCP

mix.exs

@@ -42,7 +42,8 @@ defmodule Aprsme.MixProject do
       ],
       releases: [
         aprsme: [
-          steps: [:assemble]
+          steps: [:assemble],
+          validate_compile_env: false
         ]
       ]
     ]